1 /* 2 * AppArmor security module 3 * 4 * This file contains AppArmor basic permission sets definitions. 5 * 6 * Copyright 2017 Canonical Ltd. 7 * 8 * This program is free software; you can redistribute it and/or 9 * modify it under the terms of the GNU General Public License as 10 * published by the Free Software Foundation, version 2 of the 11 * License. 12 */ 13 14 #ifndef __AA_PERM_H 15 #define __AA_PERM_H 16 17 #include <linux/fs.h> 18 19 #define AA_MAY_EXEC MAY_EXEC 20 #define AA_MAY_WRITE MAY_WRITE 21 #define AA_MAY_READ MAY_READ 22 #define AA_MAY_APPEND MAY_APPEND 23 24 #define AA_MAY_CREATE 0x0010 25 #define AA_MAY_DELETE 0x0020 26 #define AA_MAY_OPEN 0x0040 27 #define AA_MAY_RENAME 0x0080 /* pair */ 28 29 #define AA_MAY_SETATTR 0x0100 /* meta write */ 30 #define AA_MAY_GETATTR 0x0200 /* meta read */ 31 #define AA_MAY_SETCRED 0x0400 /* security cred/attr */ 32 #define AA_MAY_GETCRED 0x0800 33 34 #define AA_MAY_CHMOD 0x1000 /* pair */ 35 #define AA_MAY_CHOWN 0x2000 /* pair */ 36 #define AA_MAY_CHGRP 0x4000 /* pair */ 37 #define AA_MAY_LOCK 0x8000 /* LINK_SUBSET overlaid */ 38 39 #define AA_EXEC_MMAP 0x00010000 40 #define AA_MAY_MPROT 0x00020000 /* extend conditions */ 41 #define AA_MAY_LINK 0x00040000 /* pair */ 42 #define AA_MAY_SNAPSHOT 0x00080000 /* pair */ 43 44 #define AA_MAY_DELEGATE 45 #define AA_CONT_MATCH 0x08000000 46 47 #define AA_MAY_STACK 0x10000000 48 #define AA_MAY_ONEXEC 0x20000000 /* either stack or change_profile */ 49 #define AA_MAY_CHANGE_PROFILE 0x40000000 50 #define AA_MAY_CHANGEHAT 0x80000000 51 52 #define AA_LINK_SUBSET AA_MAY_LOCK /* overlaid */ 53 54 55 #define PERMS_CHRS_MASK (MAY_READ | MAY_WRITE | AA_MAY_CREATE | \ 56 AA_MAY_DELETE | AA_MAY_LINK | AA_MAY_LOCK | \ 57 AA_MAY_EXEC | AA_EXEC_MMAP | AA_MAY_APPEND) 58 59 #define PERMS_NAMES_MASK (PERMS_CHRS_MASK | AA_MAY_OPEN | AA_MAY_RENAME | \ 60 AA_MAY_SETATTR | AA_MAY_GETATTR | AA_MAY_SETCRED | \ 61 AA_MAY_GETCRED | AA_MAY_CHMOD | AA_MAY_CHOWN | \ 62 AA_MAY_CHGRP | AA_MAY_MPROT | AA_MAY_SNAPSHOT | \ 63 AA_MAY_STACK | AA_MAY_ONEXEC | \ 64 AA_MAY_CHANGE_PROFILE | AA_MAY_CHANGEHAT) 65 66 extern const char aa_file_perm_chrs[]; 67 extern const char *aa_file_perm_names[]; 68 69 struct aa_perms { 70 u32 allow; 71 u32 audit; /* set only when allow is set */ 72 73 u32 deny; /* explicit deny, or conflict if allow also set */ 74 u32 quiet; /* set only when ~allow | deny */ 75 u32 kill; /* set only when ~allow | deny */ 76 u32 stop; /* set only when ~allow | deny */ 77 78 u32 complain; /* accumulates only used when ~allow & ~deny */ 79 u32 cond; /* set only when ~allow and ~deny */ 80 81 u32 hide; /* set only when ~allow | deny */ 82 u32 prompt; /* accumulates only used when ~allow & ~deny */ 83 84 /* Reserved: 85 * u32 subtree; / * set only when allow is set * / 86 */ 87 u16 xindex; 88 }; 89 90 #define ALL_PERMS_MASK 0xffffffff 91 92 extern struct aa_perms allperms; 93 94 struct aa_profile; 95 96 void aa_perm_mask_to_str(char *str, const char *chrs, u32 mask); 97 void aa_audit_perm_names(struct audit_buffer *ab, const char **names, u32 mask); 98 void aa_audit_perm_mask(struct audit_buffer *ab, u32 mask, const char *chrs, 99 u32 chrsmask, const char **names, u32 namesmask); 100 void aa_apply_modes_to_perms(struct aa_profile *profile, 101 struct aa_perms *perms); 102 void aa_compute_perms(struct aa_dfa *dfa, unsigned int state, 103 struct aa_perms *perms); 104 105 #endif /* __AA_PERM_H */ 106